Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

#

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

Jump to bottom

[Security] Fix SameSite cookie CSRF protection #7539

Merged
merged 2 commits into from
Aug 19, 2021
Merged

[Security] Fix SameSite cookie CSRF protection #7539

merged 2 commits into from
Aug 19, 2021

Commits on Aug 19, 2021

  1. This fixes 2 issues related to the SameSite cookie CSRF protection 

    1. The session variable that indicates to use it was set to "true".
   However, it should be a string indicating the value to use (either
   "strict" or "lax"). See: https://www.php.net/manual/en/session.configuration.php#ini.session.cookie-samesite
2. The use_strict_mode setting (See: https://www.php.net/manual/en/session.configuration.php#ini.session.use-strict-mode)
   in PHP is not enabled by default. This means that, even when logging out, the
   session_destroy/session_start procedure reuses the old cookie and does not set a new cookie with
   the proper samesite flag. All the PHP documentation I've seen says use_strict_mode should always
   be enabled, but defaults to disabled. This explicitly overrides the php.ini setting (default false)
   to set it at the beginning of the code, ensuring that NDB_Client properly generates a new session cookie.
    @driusan
    driusan committed Aug 19, 2021
    Configuration menu
    Copy the full SHA
    36cfae2 View commit details
    Browse the repository at this point in the history

  2. phpcs:ignore long url

    @driusan
    driusan committed Aug 19, 2021
    Configuration menu
    Copy the full SHA
    fce6be7 View commit details
    Browse the repository at this point in the history